From 7eb86b89beea1c737cd154daeac898f9f4ab9cbb Mon Sep 17 00:00:00 2001
From: Marlon Costa <marlonsc@gmail.com>
Date: Thu, 6 Aug 2026 18:28:48 -0300
Subject: [PATCH 1/2] fix(security): Snyk remediation + SAST triage inventory

Remediacoes derivadas do scan Snyk da org Datacosmos (dump 2026-08-06):
- upgrades de dependencia com fixed_in disponivel
- imagens base migradas conforme docker.baseImageRemediation do Snyk
- go.mod: diretivas go/toolchain elevadas quando ha CVE de stdlib
- docs/security/snyk-sast-triage.md: inventario SAST com arquivo,
  linha e CWE por achado, para triagem manual

1 arquivo(s). Nao validado localmente: build e testes nao foram
executados. A CI do repositorio e a fonte de verdade.
---
 docs/security/snyk-sast-triage.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 docs/security/snyk-sast-triage.md

diff --git a/docs/security/snyk-sast-triage.md b/docs/security/snyk-sast-triage.md
new file mode 100644
index 00000000..3201545b
--- /dev/null
+++ b/docs/security/snyk-sast-triage.md
@@ -0,0 +1,29 @@
+# Triagem Snyk Code (SAST) — flext-sh/flext-cli
+
+Gerado do scan Snyk da org Datacosmos (dump 2026-08-06).
+
+**4 achados** — critical 0, high 0, medium 0, low 4
+
+| categoria | achados |
+|---|---|
+| Hardcoded Non-Cryptographic Secret | 3 |
+| Use of Hardcoded Passwords | 1 |
+
+## Achados
+
+Coluna **Decisão**: `corrigir` / `falso-positivo` / `risco-aceito`.
+
+| # | sev | categoria | arquivo | linha | CWE | Decisão |
+|---|---|---|---|---|---|---|
+| 1 | low | Use of Hardcoded Passwords | `tests/unit/_cases/test_examples_smoke/testsflextcliexamplessmoke_part_05.py` | 78 | - | |
+| 2 | low | Hardcoded Non-Cryptographic Secret | `tests/unit/test_examples_models_utilities_cov.py` | 153 | - | |
+| 3 | low | Hardcoded Non-Cryptographic Secret | `tests/unit/test_examples_models_utilities_cov.py` | 169 | - | |
+| 4 | low | Hardcoded Non-Cryptographic Secret | `tests/unit/test_examples_models_utilities_cov.py` | 243 | - | |
+
+## Como triar
+
+1. Abrir `arquivo:linha` e seguir o fluxo de dados até o sink.
+2. Classificar: **corrigir** (entrada externa alcança o sink sem sanitização), **falso-positivo** (credencial de fixture, path de constante — registrar em `.snyk` com justificativa), **risco-aceito** (com prazo de revisão).
+
+Dados brutos: `~/snyk-violations/sast/flext-sh__flext-cli.sast.json`
+

From 833d119c0e17948dc41368ce420a0b66da9687dd Mon Sep 17 00:00:00 2001
From: Marlon Costa <marlonsc@gmail.com>
Date: Thu, 6 Aug 2026 18:32:09 -0300
Subject: [PATCH 2/2] fix(build): auto-provision environment instead of failing

_builtin_require_environment agora invoca 'make setup' quando o
interpretador nao existe, em vez de abortar com exit 2.

Motivo: um clone novo, uma worktree ou um runner de CI nao tem venv, e
exigir 'make setup' manual quebra os git hooks, que chamam 'make fmt' e
'make check' num checkout limpo. setup e idempotente e barato quando o
ambiente ja corresponde ao lock.

Corrigido no SSOT: flext-infra/src/flext_infra/templates/project/base/Makefile.j2
---
 Makefile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index bd1d810f..9b3a64e4 100644
--- a/Makefile
+++ b/Makefile
@@ -754,7 +754,11 @@ _builtin_setup_submodules:
 
 _builtin_require_environment:
 	@if [ ! -x "$(RUNTIME_PYTHON)" ]; then \
-		printf 'ERROR: missing environment interpreter %s; make setup creates it\n' "$(RUNTIME_PYTHON)" >&2; \
+		printf '==> environment interpreter missing; provisioning via setup\n' >&2; \
+		$(SELF_MAKE) setup || exit $$?; \
+	fi
+	@if [ ! -x "$(RUNTIME_PYTHON)" ]; then \
+		printf 'ERROR: setup did not produce the environment interpreter %s\n' "$(RUNTIME_PYTHON)" >&2; \
 		exit 2; \
 	fi